Under Door Tool Kit Instructions 


The Under Door Tool — occasionally referred to by some suppliers as a “lever opening tool” — is one of 
the fastest and most effective ways of entering a target room or facility. Making use of modern 
workplace codes requiring that doors operate with lever handles (as opposed to round knobs) and the 
fact that many doors will open without the use of keys or badges if the inside handle is used, these 
bypass devices are a very powerful and useful addition to one’s penetration testing kit. 


However, despite efforts by various manufacturers to produce a compact version of this tool, very few 
users would consider the most commonly-available Under Door Tools to be highly transportable. They 
are certainly not a pleasure to contend with while traveling to and from an engagement. It is for this 
reason that The CORE Group advocates the carrying of a small supply kit instead of a full-size Under 
Door Tool as part of your Red Teaming gear. Kept at the ready, it is possible to use this supply kit in 
order to fabricate an Under Door Tool on-site either with found material or with a single piece of rod 
stock purchased at a local hardware store. 


The following pages of this guide offer up a series of suggested steps for making use of The CORE Group 
Under Door Tool Kit. 


Once a target door has been identified, it is 
possible to fabricate a properly-sized Under Door 
Tool exclusively from the outer, secure side of the 
door. 


The latch handle’s height and position on the outer 
side should in almost all instances match the inside. 
Follow the steps suggested here in order to 
produce an Under Door Tool for just about any 
target. 


This process can be tackled with an Under Door Kit 
from The CORE Group’s equipment supply catalog 
and a metal rod ideally at least 6” longer than the 


height of the handle as measured from the floor 


Rods of this style can be regularly found at hardware stores for very little cost. Four foot lengths are 
common and tend to be effective. 
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Step One 
Begin by making a small bend near one end of the rod. 


Approximately 2” of metal should be bent at as near to a 90 degree 
angle as possible. If you have pliers or a multi-tool they can be a help, 
but a manual bend by hand can also usually be sufficient. 


STEP TWO 


Right now, the rod is of course taller than the target door handle. If 
held against the door, however, the bent portion should be long 
enough that its tip will reach out beyond the handle. 


The ultimate purpose of the Under Door Tool is to deliver a string or 
rope up and over the handle on the inside of the door. 
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y STEP THREE 


Flip the tool over so that the bent 
portion is now down on the floor. The 
height of the door handle will serve as 
a guide when you make the upcoming 
bends at the other end of the rod. 


Some people report that it is helpful to 
slip the already-bent tip of the rod 
(down at the floor level at this time) 
under the door and we do not disagree 
with this practice. 


STEP FOUR 


Firmly grasp the straight end of the rod 
and bend it downward, away from the 
door, making the angle just above the 
height of the handle. The resulting 
bend should be close to 90 degrees 
and as tight as possible. 


These two bends in the metal should 
be directly opposite one another, such 
that the rod could lay perfectly flat on 
the ground at this time. 
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STEP FIVE 


Make an additional 90 degree bend in the same end of the rod upon 
which you were just working. Make this bend approximately two 
inches closer to the tip than the bend in Step Four. 


The ultimate aim is to make a rather sharply-defined “U” shape at this 
end of the Under Door Tool, with the flat bottom portion of the “U” of 
a width that is close to (but slightly wider than) the thickness of your 
target door. 


STEP SIX 


Flip the rod back over again. The “U” shaped portion is the operator's 
handle segment of the Under Door Tool. The small bent portion from 
Step One is the working end which will ultimately deliver a length of 
Kevlar cord to the inside handle of the target door. 


Unpack your Under Door Kit supplies and prepare to finish the 
fabrication of this working end. 
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STEP SEVEN 


Cut a segment of the Kevlar line approximately 6 feet in length. 


Affix it to the working end of your tool with a clove hitch knot, 
approximately one half-inch from the tip ofthe rod. 


STEP EIGHT 


Secure this knot with using a small segment of gaffer’s tape. The 
notion is to both prevent the knot from sliding and also to create a 
small bump near the working end of the tool which can help to grab 
target door handles without slipping off. 


STEP NINE 


Feed the free end of the Kevlar cord 
through a three inch piece of heat-shrink 
tubing and slide the tubing up and 
around so that it covers the working end 
ofthe Under Door Tool from tip to bend. 


STEP TEN 


Using either the included source of fire 
or a personal lighter or heat gun, activate 
the heat shrink tubing. NOTE - Do not 
apply the flame directly, as this will 


scorch the rubber, possibly damaging it. 
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STEP ELEVEN 


The metal ring included in The CORE Group’s Under Door Kit serves as 
a handle for the user. It is a great deal easier and more comfortable 
to pull hard upon the Kevlar line by means of a handle as opposed to 
simply wrapping the cord around one’s hand. 


Typically, a cow hitch is used to quickly flip the Kevlar line around the 
metal ring using the lanyard looping technique. This easily-slipped knot can be repositioned at will and 
the handle’s location can thus be adjusted quickly and easily. 


STEP TWELVE 


Your Under Door Tool is now complete and has been tailored to the 
exact size and height necessary for an attempt on the door in 
question. 


Most likely, this whole construction process will not have taken more 
than a few minutes. 


Feel free to use the gear ties included in the CORE Group kit to help 
police the Kevlar line when the tool is being carried. As you will see 
when performing these attacks, appropriate management of the cord 
is essential. 
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Under Door Tool USAGE 


If you have participated in one of The CORE Group’s Physical Penetration courses, then chances are you 
have already gotten some hands-on time with an Under Door Tool and attempted using it. This section, 
however, serves as a reminder for the basic operation of this very effective entry tool. 


POSITION THE BOTTOM OF THE TOOL 


Many users report that simply inserting an Under Door Tool beneath their target 
door can be the hardest part of its use. Contending with tight spaces, thick 
carpets, and an inability to see what is happening on the other side are all 
considerations. However, as long as you take care to not allow your Kevlar line 
to become tangled and you position the bottom part of the “U” section just 
beneath the tip of the door handle, things should work out well for you. 


POSITION THE TOP OF THE TOOL 


With the bottom of the tool in the correct location, a user must then manipulate 
the handle to swing the arm of the tool toward the door handle. Take care to 
rock the tool toward you so that the upright rod remains tight against the door’s 
inner side as it moves. You should be able to feel when the working end has 
struck the inside door handle’s shaft. 


PULL HARD AND ATTEMPT TO OPEN THE DOOR 


Pulling on the Kevlar cord (use the metal ring to help you) should cause the 
Under Door Tool’s upright rod to flex while the rubber-coated working end 
(rubberized by means of the heat shrink) pulls down on the lever handle on the 
inside of the target door. 


It is often difficult to “hold” the handle in its down position, so be ready to 
immediately attempt to open the door while pulling on the Kevlar line. Having a 
second person to assist you can help. 
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The following series of images show the Under Door Tool attack process from the outside. 


POSITION THE BOTTOM OF THE TOOL 


Here we see a penetration tester situating an Under Door Tool in exactly the 
right location. With the handle segment and the bottom of the “U” bend 
immediately beneath the tip of the door handle (he is estimating the location of 
the inside handle given the strong likelihood that the inside is a perfect mirror of 
the outside of the door) he is ready to move the working end into position. 


POSITION THE TOP OF THE TOOL 


While taking care to keep the Kevlar line out of the way, the penetration tester 
now swings the upright segment of the Under Door Tool to his right, sweeping it 
across the inner surface of the door and ultimately landing the working end 
against the inner edge of the inside door handle. 


PULL HARD AND ATTEMPT TO OPEN THE DOOR 


And here we see that with a solid pull of the Kevlar line, the inner handle is 
activated and the latches all retract, allowing the door to open. 


NOTE - If an attempt is unsuccessful, it is wise to slide your Under Door Tool back out to your side of the door 
and inspect it for bends or damage. The upright rod will flex somewhat during use, but if you miss the handle 
or if the working end slips off while you are pulling, the tool may bend severely. This is not a defeat, of course. 
Use your hands to adjust the shape of the tool as necessary and make an additional attempt. 
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ADDITIONAL TIPS 


Here are a few more points of which you should be aware when using an Under Door Tool... 


USE A PRACTICE DOOR 


Often, nearly all of the doors in a facility will be fairly uniform. If 
construction of a facility happened all at once, chances are that a 
server room door will be the same as office doors which will be the 
same as closet doors. 


Instead of attempting to attack your target door immediately, 
consider finding a less secure (and possibly less visible) alternate door 
to use as practice (and for sizing help while fabricating your tool). 
Such a door may even be unlocked, allowing you and a partner to 
communicate freely about how the tool moves and positions itself as 
you attempt to reach the inside handle. 


LOOK THROUGH TO THE OTHER SIDE 


If a target door features a window on or near it, this can be a huge 
help. While it is often not easy for the operator using an Under Door 
Tool to view the other side, having a partner who can look through 
such a window will often come in very handy. 


Even if no such window is available to you, a snake-cam or endoscope 
can be repurposed for this task. The CORE Group sells a USB model 
that can be attached to a laptop or mobile device in order to gain a 
better perspective on what is happening on the inside of your target 
door. 
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BE AWARE OF MOVING DOOR BOTTOMS 


Some doors today are equipped with bottom elements that press down and forcefully squeeze against 
the floor when the door is closed. Sometimes these are mortised up within the door itself, while other 
times such hardware is an add-on affixed to the door’s bottom edge on the inside surface. These door 
bottoms work by means of a plunger sticking out to the side. When the door swings shut, the plunger is 
moved by the door frame. This causes the bottom plate to press downward into the floor. 


Often, hardware such as this is simply used to improve a door’s weather-stripping seal and to make the 
door more resistant to leaks of temperature or light without dragging the bottom surface along the floor 
whenever the door opens and closes. However, some variants of this type of hardware are known as 
Security Door Bottoms and they are designed to specifically thwart Under Door Tool use by interlocking 
with a contoured floor plate. Even simple weather-stripping door bottoms can make attacks such as this 
more difficult, but unless a product is designed specifically to function as a Security Door Bottom, it is 
unlikely that Under Door Tool attacks will be prevented completely. 


The following photos show an add-on style moving door bottom. It is not a high security installation, 
given that no contoured floor plate is present to interlock with the moving plate as it drops down. 
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